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DETAILED ACTION 

1. A request for continued examination under 37 CFR 1. 1 14, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1. 1 14. Applicant's submission filed on 30 
August 2005 has been entered. Applicant's amendment filed on 30 October 2005 has 
now cancelled claims 4, 7, 23, and 33. Claims 1-3, 5-6, 8-22, 24-32, and 34-37 remain 
pending in this application. 



Response to Arguments 

2. Applicant's arguments filed 30 October 2005 have been fully considered but they 
are not persuasive. 

Regarding applicant's response to 103(a) rejection : While the examiner 
appreciates applicant's efforts in amending the claims to distinguish the claimed 
invention over the prior art, the examiner submits that applicant's amendment to 
independent claims 1, 20, and 27 does not clearly render the claimed invention non- 
obvious for the following reasons. First, applicant's arguments that the prior art does 
not teach the feature relating to the user computer and the central service computer 
both having antivirus databases that are updated is not persuasive since this feature is 
only recited in the preamble of the claim. Appropriate weight is given to limitations 
recited in the body of the claim that are needed for purpose of antecedence. "A mere 
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statement of purpose or intended use in the preamble of a claim need not be 
considered in finding anticipation; however, it must be considered if the language of a 
preamble is necessary to give meaning to the claim" Diversitech Corp. v. Century Steps, 
Inc., 7 USPQ2d 1315 (Fed. Cir. 1988); In re Stencel, 4 USPQ2d 1071 (Fed. Cir. 1987). 
That is, there are no claim limitations in the body of the claim that specifically require 
both the user computer and the central service computer to both have antivirus 
databases. In this case, the claimed limitation only requires that ''the antivirus 
database" be updated. Here, the claim clearly only requires that the central service 
computer, and the user computer, be configured to send new antivirus files to each 
other, not that they both have antivirus databases. That is, this limitation does not 
expressly specify or require that both the user computer and the central service 
computer actually have antivirus databases or that both databases would be mutually 
updated. MPEP 2106 recites the following supporting rational for this interpretation: 

"While it is appropriate to use the specification to determine what applicant intends a term 
to mean, a positive limitation from the specification cannot be read into a claim that does 
not impose that limitation. A broad interpretation of a claim by Office personnel will 
reduce the possibility that the claim, when issued, will be interpreted more broadly than is 
justified or intended. An applicant can always amend a claim during prosecution to better 
reflect the intended scope of the claim." 

Here, the examiner suggests an amendment to independent claims 1, 20, and 27 
specifically requiring both the user computer and the central service computer to have 
antivirus databases that are mutually updated by the method disclosed in Figure 6 of 
applicant's specification to help clarify this issue. 
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Second, applicant's arguments relating to the subject matter of cancelled claims 
4, 7, 23, and 33, now amended into independent claims 1, 20, and 27, is not persuasive 
since the recited features are rendered obvious by Hodges as follows: 

- notifying central service computer of new antivirus file on user computer and user 
computer inquiring whether to update antivirus database: Hodges teaches notifying 
server of user update requirements (CL9-L53-55, CL9-L62-67, Fig. 7) and new virus 
definitions (CL5-41). (Also see: McAfee Orchestrator (Hodges background) which 
provides programmable intelligent agents for reporting back any antivirus events to the 
server (pp. 16), and controlling antivirus file downloads and periodic updates (pp.11 -18)) 

- central service computer configured to periodically obtain antivirus files from the 
antivirus server: Hodges teaches notifying server of user update requirements (CL9- 
L53-55, CL9-L62-67, Fig. 7), new virus definitions (CL5-41), antivirus signature files 
(CL8-L51-65, Fig. 5b), automatic (i.e. periodic) file updating (CL5-L29), and version 
number (CL9-L47, CL16-L27). (Also see: McAfee Orchestrator (Hodges background) 
which provides programmable intelligent agents for reporting back any antivirus events 
to the server (pp. 16), and controlling antivirus file downloads and periodic updates 
(pp.1 1-18)) 



- user computer waits for request from central service computer after notification of new 
antivirus data file: Hodges teaches notifying server of user update requirements (CL9- 
L53-55, CL9-L62-67, Fig. 7) and new virus definitions (CL5-41). 'Waiting" for a request 
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from the central computer before sending a new file would obviously be necessary for 
synchronization purposes. (Also see: McAfee Orchestrator (Hodges background) which 
provides programmable intelligent agents for reporting back any antivirus events to the 
server (pp. 16), and controlling antivirus file downloads and periodic updates (pp. 11-18)) 

Further, and as previously noted, such features are available in commercial 
antivirus products such as McAfee (disclosed in applicant's specification on page 5, line 
13, and in prior art Hodges. Background) McAfee VirusScan 4.5, for example, provides 
features which allow for the detection of new viruses at the local computer level, and 
subsequent notification central administrator using the programmable Orchestrator 
feature for configuring automatic antivirus file updates, scans, and DAT file updates. 
(See: McAfee VirusScan 4.5, Product Description, page 2, Central Policy Reporting and 
Advanced Enterprise Reporting, for example) Hence, a skilled artisan would have 
known to use the McAfee Orchestrator programmable configuration features to realize 
the realize the claimed elements relating to notifying central service computer of new 
antivirus files, periodically obtaining antivirus files from the antivirus server, and waiting 
for request from central service computer for sending updates. (See: "epolicy 
Orchestrator" Product Guide, Version 2.0, pp. 11-18) Here the Orchestrator provides 
programmable intelligent agents for reporting back any antivirus events to the server 
(pp. 16), and controlling antivirus file downloads and periodic updates, (pp. 11-18) 

Accordingly, for the reasons set forth above and below under 103(a) rejections, 
the examiner maintains the prior art rejection of claims 1-3, 5-6, 8-22, 24-32, and 34-37. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

4. Claims 1-3, 5-6, 8-22, 24-32, and 34-37 are rejected under 35 U.S.C. 103(a) as 

being unpatentable over U.S. Patent 6,269,456 issued to Hodges et al in view of 

U.S. Patent 6,327,594 issued to Van Huben et al. 

Regarding independent claims 1. 20. and 27 : Hodges teaches a method, system, 
and computer code, for maintaining and updating antivirus files within a computer 
network consisting of user computers, central service computer, and antivirus server. 
(Abstract, Summary of Invention, Figs. 3, 4, 8, 10, 12) Hodges teaches the elements of 
the claimed limitations of the present invention as follows: 
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- method/system/code for maintaining updated antivirus files in computer network with, 
computer & central service computer having antivirus database, network connected to 
antivirus server : Hodges teaches updating antivirus files in a computer network (CL4- 
L53-67) inclusive of a central service computer having the antivirus database (CL15- 
L22) and a network connected to an antivirus server (CL9-L62 to CL10-L11, Fig. 7). 

- receiving new antivirus file (database) at user computer and central service computer 
and updating the computer's antivirus database : Hodges teaches receiving new 
antivirus files in a database (CL7-L45-63, Fig. 4) at user computer and central service 
computer (CL7-L1-3) and subsequently updating the computer's antivirus database 
(CL9-L53-55, CL9-L62-67, Fig. 7). 

memory for temporary antivirus storage : The system disclosed by Hodges is obviously 
inclusive of memory for temporary storage of antivirus files (the system disclosed in 
Figs. 3 and Ware obviously inclusive of RAM memory). 

- where the central service computer and user computer are configured to send new 
antivirus file to other central service computer and user computer to update the antivirus 
database : Hodges discloses sending new antivirus files to the service computer and 
and user computer in updating the antivirus database (CL7-L1-3, 45-63, CL9-L53-55, 
62-67, Figs. 4 and 7). 
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- notifying central service computer of new antivirus file on user computer and user 
computer inquiring whether to update antivirus database : Hodges teaches notifying 
server of user update requirements (CL9-L53-55, CL9-L62-67, Fig. 7) and new virus 
definitions (CL5-41). (Also see: McAfee Orchestrator (Hodges background) which 
provides programmable intelligent agents for reporting back any antivirus events to the 
server (pp. 16), and controlling antivirus file downloads and periodic updates (pp. 1 1-18)) 

- central service computer configured to periodically obtain antivirus files from the 
antivirus server : Hodges teaches notifying server of user update requirements (CL9- 
L53-55, CL9-L62-67, Fig. 7), new virus definitions (CL5-41), antivirus signature files 
(CL8-L51-65, Fig. 5b), automatic (i.e. periodic) file updating (CL5-L29), and version 
number (CL9-L47, CL16-L27). (Also see: McAfee Orchestrator (Hodges background) 
which provides programmable intelligent agents for reporting back any antivirus events 
to the server (pp. 16), and controlling antivirus file downloads and periodic updates 
(PP-11-18)) 



- user computer waits for reguest from central service computer after notification of new 
antivirus data file : Hodges teaches notifying server of user update requirements (CL9- 
L53-55, CL9-L62-67, Fig. 7) and new virus definitions (CL5-41). 'Waiting" for a request 
from the central computer before sending a new file would obviously be necessary for 
synchronization purposes. (Also see: McAfee Orchestrator (Hodges background) which 
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provides programmable intelligent agents for reporting back any antivirus events to the 
server (pp. 16), and controlling antivirus file downloads and periodic updates (pp. 1 1-18)) 

Further, such features are available in commercial antivirus products such as 
McAfee (disclosed in applicant's specification on page 5, line 13, and in prior art 
Hodges, Background) McAfee VirusScan 4.5, for example, provides features which 
allow for the detection of new viruses at the local computer level and subsequent 
notification central administrator using the programmable Orchestrator feature for 
configuring automatic antivirus file updates, scans, and DAT file updates. (See: McAfee 
VirusScan 4.5, Product Description, page 2, Central Policy Reporting and Advanced 
Enterprise Reporting, for example) Hence, a skilled artisan would have known to use 
the McAfee Orchestrator programmable configuration features to realize the realize the 
claimed elements relating to notifying central service computer of new antivirus files, 
periodically obtaining antivirus files from the antivirus server, and waiting for request 
from central service computer for sending updates. (See: "epolicy Orchestrator" Product 
Guide, Version 2.0, pp. 11-18) Here the Orchestrator provides programmable intelligent 
agents for reporting back any antivirus events to the server (pp. 16), and controlling 
antivirus file downloads and periodic updates, (pp. 11 -18) 

Hodges does not explicitly disclose comparing databases between a user 
computer and a host (server) computer system. 
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Van Huben teaches comparing the databases between central (host) computer 
and user (client) computer to determine if databases require updating (i.e. new files). 
(Abstract Summary, Figs. 3a-4a) Van Huben teaches the elements of the claimed 
limitations of the present invention as follows: 

- comparing antivirus databases of central service computer (application) and 
user computer to determine if databases contain new antivirus file not 
contained within the other database : Van Huben teaches comparing databases 
between central (host) computer and user computer to determine if databases require 
updating of new files. (CL4-L18-33, especially L29-32) 

It would have been obvious to one having ordinary skill in the art at the time the 
claimed invention was made to modify the teachings of Hodges relating to updating an 
antivirus database over a network, with the teachings of Van Huben relating to 
comparing databases between a client and central server, to realize the claimed 
invention. An obvious motivation exists since, in this case, the Hodges reference 
teaches to the Van Huben reference, and the Van Huben reference teaches to the 
Hodges reference. Specifically, both Hodges and Van Huben teach the maintaining and 
updating databases and are used in the same technological arena as noted above. 
Hodges teaches to Van Huben because Hodges discloses that client databases require 
frequent updating from the central server (See: Hodges CL3-L51). Van Huben teaches 
to Hodges because Van Huben specifically teaches the means for comparing 
databases between a central server and a client (user) computer to facilitate updating. 
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(See: Van Huben: CL4-L29-32) Further, the level of skill required by an artisan to realize 
the claimed limitations of the present invention is clearly established by both references. 
(See: Hodges/Van Huben, Background) Accordingly, a skilled artisan having access to 
the teachings of Hodges and Van Huben, would have knowingly modified the teachings 
of Hodges with the teachings of Van Huben (or visa versa) to realize the claimed 
elements of the present invention. 

Per dependent claim 2-3. 21-22. and 24 : Hodges teaches a network with multiple 
users connected to a central service computer and an antivirus database for obtaining 
antivirus files (CL7-L1-3, 45-63, CL9-L53-55, 62-67, Figs. 4 and 7). 

Per dependent claims 5 and 6 : Hodges teaches a central server connected to the 
Internet and hosting a web site. (CL2-L51, Figs. 8, 10) 

Per dependent claims 8-11. 14. 16-18. 24. 25, 31. 32 : Hodges teaches notifying 
server of user update requirements (CL9-L53-55, CL9-L62-67, Fig. 7), new virus 
definitions (CL5-41), antivirus signature files (CL8-L51-65, Fig. 5b), automatic file 
updating (CL5-L29), and version number (CL9-L47, CL16-L27). 

Per dependent claims 12-13. 26. 29. and 30 : Hodges teaches detecting and 
cleaning infected data files using newly updated files (CL3-L29-41, Fig. 1). 

Per dependent claims 15 and 19 : These claims are rendered obvious by the 
teachings of Van Huben relating to comparing databases between a central server and 
a client (user) computer to facilitate updating (CL4-L29-32) and hence would have 
knowingly been incorporated by a skilled artisan using the reasoning previously cited 
above. 
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Per dependent claim 28 : This claim is rendered obvious by the distribution 
means disclosed by Hodges that discloses antivirus file distribution by CD-ROM, 
Internet, etc. (See: CL1-L65 to CL2-L11) 

Per dependent claim 34 : Hodges teaches notifying server of user update 
requirements (CL9-L53-55, CL9-L62-67, Fig. 7) and new virus definitions (CL5-41). 
'Waiting" for a request from the central computer before sending a new file would 
obviously be necessary for synchronization purposes. Van Huben teaches comparing 
databases between a central server and a client (user) computer to facilitate updating 
(CL4-L29-32) and hence would have knowingly been incorporated by a skilled artisan 
using the reasoning previously cited above. 

Per dependent claims 35-37 : These claims are rendered obvious by the 
teachings of Van Huben relating to comparing databases between a central server and 
a client (user) computer to facilitate updating (CL4-L29-32) and hence would have 
knowingly been incorporated by a skilled artisan using the reasoning previously cited 
above. Hodges teaches a central server connected to the Internet and hosting a web 
site. (CL2-L51, Figs. 8, 10) 

Conclusion 

5. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. Careful consideration should be given prior to applicant's 
response to this Office Action. 
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"Surfing the Net for Software Engineering Notes", M. Doernhoefer, ACM 
SI G SOFT, Software Engineering Notes, Vol. 26, No. 2, March 2001 teaches antivirus 
database updating. 

U.S. Patent 6,151,643 issued to Chang et al updating client databases. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Fred Ferris whose telephone number is 571-272-3778 
and whose normal working hours are 8:30am to 5:00pm Monday to Friday. Any inquiry 
of a general nature relating to the status of this application should be directed to the 
group receptionist whose telephone number is 571-272-3700. If attempts to reach the 
examiner by telephone are unsuccessful, the examiner's supervisor, Kamini Shah can 
be reached at 571-272-2279. The Official Fax Number is: (703) 872-9306 

<Frecf<Ferris, Patent Examiner 
Simulation and Emulation, Art Unit 2128 
U.S. Patent and Trademark Office 
Randolph Building, Room 5D19 
401 Dulany Street 
Alexandria, VA 22313 
Phone: (571-272-3778) 
Fred.Ferris@uspto.gov 
November 11, 2005 




